Skip to content

Spring Boot migration - KeyVault starter #10597

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hemanttanwar merged 11 commits into from
May 25, 2020
Merged

Spring Boot migration - KeyVault starter #10597

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
0370687
add spring boot for key vault
saragluna Apr 19, 2020
3210b34
include property file
saragluna Apr 29, 2020
1d4ce50
address review comments
saragluna May 6, 2020
0933113
add azure-spring-boot in jacoco-test-coverage pom file to make build-…
saragluna May 8, 2020
6364a53
Merge branch 'master' into feature/spring-boot-keyvault
saragluna May 8, 2020
ae4c040
upgrade azure-identity version used in spring-boot
saragluna May 8, 2020
d8caed5
move Spring versions to version_client.txt to keep consistency
saragluna May 9, 2020
7538e12
add CHANGELOG.md
saragluna May 14, 2020
c4df875
add configurations for JavaDoc plugins and entries in jacoco-test-cov…
saragluna May 21, 2020
15677eb
fix artifact id of key-vault-starter in docs
saragluna May 22, 2020
e823448
fix artifact id of aad-starter in docs
saragluna May 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions eng/jacoco-test-coverage/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,26 @@
<artifactId>azure-sdk-template</artifactId>
<version>1.0.4-beta.13</version> <!-- {x-version-update;com.azure:azure-sdk-template;current} -->
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>azure-spring-boot</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-spring-boot;current} -->
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>azure-spring-boot-starter</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-spring-boot-starter;current} -->
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>azure-active-directory-spring-boot-starter</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-active-directory-spring-boot-starter;current} -->
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>azure-keyvault-secrets-spring-boot-starter</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-keyvault-secrets-spring-boot-starter;current} -->
</dependency>
</dependencies>

<build>
Expand Down
4 changes: 4 additions & 0 deletions eng/versioning/version_client.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ com.azure:azure-storage-perf;1.0.0-beta.1;1.0.0-beta.1
com.azure:azure-storage-queue;12.5.1;12.6.0-beta.1
com.azure:perf-test-core;1.0.0-beta.1;1.0.0-beta.1
com.azure:azure-test-watcher;1.0.0-beta.1;1.0.0-beta.1
com.microsoft.azure:azure-spring-boot;2.2.4;2.2.5-beta.1
com.microsoft.azure:azure-spring-boot-starter;2.2.4;2.2.5-beta.1
com.microsoft.azure:azure-active-directory-spring-boot-starter;2.2.4;2.2.5-beta.1
com.microsoft.azure:azure-keyvault-secrets-spring-boot-starter;2.2.4;2.2.5-beta.1

# Unreleased dependencies: Copy the entry from above, prepend "unreleased_" and remove the current
# version. Unreleased dependencies are only valid for dependency versions.
Expand Down
3 changes: 0 additions & 3 deletions eng/versioning/version_data.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,3 @@ com.microsoft.azure.msi_auth_token_provider:azure-authentication-msi-token-provi
com.microsoft.azure:azure-eventgrid;1.4.0-beta.1;1.4.0-beta.1
com.microsoft.azure:azure-loganalytics;1.0.0-beta-2;1.0.0-beta.2
com.microsoft.azure:azure-media;1.0.0-beta.1;1.0.0-beta.1
com.microsoft.azure:azure-spring-boot;2.2.4;2.2.5-beta.1
com.microsoft.azure:azure-spring-boot-starter;2.2.4;2.2.5-beta.1
com.microsoft.azure:azure-active-directory-spring-boot-starter;2.2.4;2.2.5-beta.1
4 changes: 2 additions & 2 deletions sdk/spring/azure-spring-boot-starter-active-directory/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ The authorization flow is composed of 3 phrases:

#### Add Maven Dependency

`azure-spring-boot-starter-active-directory` is published on Maven Central Repository.
`azure-active-directory-spring-boot-starter` is published on Maven Central Repository.
If you are using Maven, add the following dependency.

[//]: # "{x-version-update-start;com.azure:azure-spring-boot-starter-active-directory;dependency}"
[//]: # "{x-version-update-start;com.azure:azure-active-directory-spring-boot-starter;current}"
```xml
<dependency>
<groupId>com.azure</groupId>
Expand Down
70 changes: 70 additions & 0 deletions sdk/spring/azure-spring-boot-starter-active-directory/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,76 @@
</rules>
</configuration>
</plugin>
<!-- START: Empty Java Doc -->
<!-- The following code will generate an empty javadoc with just a README.md. This is necessary
to pass the required checks on Maven. The way this works is by setting the classesDirectory
to a directory that only contains the README.md, which we need to copy. If the classesDirectory
is set to the root, where the README.md lives, it still won't have javadocs but the jar file
will contain a bunch of files that shouldn't be there. The faux sources directory is deleted
and recreated with the README.md being copied every time to guarantee that, when building locally,
it'll have the latest copy of the README.md file.
-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.1.1</version> <!-- {x-version-update;org.apache.maven.plugins:maven-javadoc-plugin;external_dependency} -->
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
<configuration>
<skip>true</skip>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>3.1.2</version> <!-- {x-version-update;org.apache.maven.plugins:maven-jar-plugin;external_dependency} -->
<executions>
<execution>
<id>empty-javadoc-jar-with-readme</id>
<phase>package</phase>
<goals>
<goal>jar</goal>
</goals>
<configuration>
<classifier>javadoc</classifier>
<classesDirectory>${project.basedir}/javadocTemp</classesDirectory>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-antrun-plugin</artifactId>
<version>1.8</version> <!-- {x-version-update;org.apache.maven.plugins:maven-antrun-plugin;external_dependency} -->
<executions>
<execution>
<id>copy-readme-to-javadocTemp</id>
<phase>prepare-package</phase>
<configuration>
<target>
<echo>Deleting existing ${project.basedir}/javadocTemp</echo>
<delete includeEmptyDirs="true" quiet="true">
<fileset dir="${project.basedir}/javadocTemp"/>
</delete>
<echo>Copying ${project.basedir}/README.md to
${project.basedir}/javadocTemp/README.md
</echo>
<copy file="${project.basedir}/README.md" tofile="${project.basedir}/javadocTemp/README.md"/>
</target>
</configuration>
<goals>
<goal>run</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- END: Empty Java Doc -->
</plugins>
</build>
</project>
3 changes: 3 additions & 0 deletions sdk/spring/azure-spring-boot-starter-keyvault-secrets/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# Release History

## 2.2.5-beta.1 (Unreleased)
104 changes: 104 additions & 0 deletions sdk/spring/azure-spring-boot-starter-keyvault-secrets/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
## Azure Key Vault Secrets Spring boot starter client library for Java
Azure Key Vault Secrets Spring boot starter is Spring starter for [Azure Key Vault Secrets](https://docs.microsoft.com/rest/api/keyvault/about-keys--secrets-and-certificates#BKMK_WorkingWithSecrets). With this starter, Azure Key Vault is added as one of Spring PropertySource, so secrets stored in Azure Key Vault could be easily used and conveniently accessed like other externalized configuration property, e.g. properties in files.

## Key concepts

## Getting started
### Add the dependency

`azure-keyvault-secrets-spring-boot-starter` is published on Maven Central Repository.
If you are using Maven, add the following dependency.

[//]: # ({x-version-update-start;com.azure:azure-keyvault-secrets-spring-boot-starter;current})
```xml
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-keyvault-secrets-spring-boot-starter</artifactId>
<version>2.2.5-beta.1</version>
</dependency>
```
[//]: # ({x-version-update-end})

### Custom settings
To use the custom configuration, open `application.properties` file and add below properties to specify your Azure Key Vault url, Azure service principal client id and client key. `azure.keyvault.enabled` is used to turn on/off Azure Key Vault Secret property source, default is true. `azure.keyvault.token-acquiring-timeout-seconds` is used to specify the timeout in seconds when acquiring token from Azure AAD. Default value is 60 seconds. This property is optional. `azure.keyvault.refresh-interval` is the period for PropertySource to refresh secret keys, its value is 1800000(ms) by default. This property is optional. `azure.keyvault.secret.keys` is a property to indicate that if application using specific secret keys, if this property is set, application will only load the keys in the property and won't load all the keys from keyvault, that means if you want to update your secrets, you need to restart the application rather than only add secrets in the keyvault.
```
azure.keyvault.enabled=true
azure.keyvault.uri=put-your-azure-keyvault-uri-here
azure.keyvault.client-id=put-your-azure-client-id-here
azure.keyvault.client-key=put-your-azure-client-key-here
azure.keyvault.tenant-id=put-your-azure-tenant-id-here
azure.keyvault.token-acquire-timeout-seconds=60
azure.keyvault.refresh-interval=1800000
azure.keyvault.secret.keys=key1,key2,key3
```

### Use MSI / Managed identities
#### App Services
To use managed identities for App Services - please refer to [How to use managed identities for App Service and Azure Functions](https://docs.microsoft.com/azure/app-service/app-service-managed-service-identity).

To use it in an App Service, add the below properties:
```
azure.keyvault.enabled=true
azure.keyvault.uri=put-your-azure-keyvault-uri-here
```

#### VM
To use it for virtual machines, please refer to [Azure AD managed identities for Azure resources documentation](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/).

To use it in a VM, add the below properties:
```
azure.keyvault.enabled=true
azure.keyvault.uri=put-your-azure-keyvault-uri-here
azure.keyvault.client-id=put-your-azure-client-id-here
```

If you are using system assigned identity you don't need to specify the client-id.

### Save secrets in Azure Key Vault
Save secrets in Azure Key Vault through [Azure Portal](https://blogs.technet.microsoft.com/kv/2016/09/12/manage-your-key-vaults-from-new-azure-portal/) or [Azure CLI](https://docs.microsoft.com/cli/azure/keyvault/secret).

You can use the following Azure CLI command to save secrets, if Key Vault is already created.
```
az keyvault secret set --name <your-property-name> --value <your-secret-property-value> --vault-name <your-keyvault-name>
```
> NOTE
> To get detail steps on how setup Azure Key Vault, please refer to sample code readme section ["Setup Azure Key Vault"](../azure-spring-boot-samples/azure-spring-boot-sample-keyvault-secrets/README.md)

> **IMPORTANT**
> Allowed secret name pattern in Azure Key Vault is ^[0-9a-zA-Z-]+$, for some Spring system properties contains `.` like spring.datasource.url, do below workaround when you save it into Azure Key Vault: simply replace `.` to `-`. `spring.datasource.url` will be saved with name `spring-datasource-url` in Azure Key Vault. While in client application, use original `spring.datasource.url` to retrieve property value, this starter will take care of transformation for you. Purpose of using this way is to integrate with Spring existing property setting.

### Get Key Vault secret value as property
Now, you can get Azure Key Vault secret value as a configuration property.

<!-- embedme ../azure-spring-boot/src/samples/java/com/azure/spring/keyvault/KeyVaultSample.java#L18-L32 -->
```
@SpringBootApplication
public class KeyVaultSample implements CommandLineRunner {

@Value("${your-property-name}")
private String mySecretProperty;

public static void main(String[] args) {
SpringApplication.run(KeyVaultSample.class, args);
}

@Override
public void run(String... args) {
System.out.println("property your-property-name value is: " + mySecretProperty);
}
}
```
## Examples
Please refer to [sample project here](../azure-spring-boot-samples/azure-spring-boot-sample-keyvault-secrets).

## Allow telemetry
Microsoft would like to collect data about how users use this Spring boot starter. Microsoft uses this information to improve our tooling experience. Participation is voluntary. If you don't want to participate, just simply disable it by setting below configuration in `application.properties`.
```
azure.keyvault.allow.telemetry=false
```
When telemetry is enabled, an HTTP request will be sent to URL `https://dc.services.visualstudio.com/v2/track`. So please make sure it's not blocked by your firewall.
Find more information about Azure Service Privacy Statement, please check [Microsoft Online Services Privacy Statement](https://www.microsoft.com/privacystatement/OnlineServices/Default.aspx).

## Troubleshooting
## Next steps
## Contributing
129 changes: 129 additions & 0 deletions sdk/spring/azure-spring-boot-starter-keyvault-secrets/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://maven.apache.org/POM/4.0.0"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>com.azure</groupId>
<artifactId>azure-client-sdk-parent</artifactId>
<version>1.7.0</version> <!-- {x-version-update;com.azure:azure-client-sdk-parent;current} -->
<relativePath>../../parents/azure-client-sdk-parent</relativePath>
</parent>

<groupId>com.microsoft.azure</groupId>
<artifactId>azure-keyvault-secrets-spring-boot-starter</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-keyvault-secrets-spring-boot-starter;current} -->

<name>Azure Key Vault Secrets Spring Boot Starter</name>
<description>Spring Boot Starter supporting Azure Key Vault Secrets as PropertySource</description>
<url>https://github.com/Azure/azure-sdk-for-java</url>

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
<version>2.2.0.RELEASE</version> <!-- {x-version-update;org.springframework.boot:spring-boot-starter;external_dependency} -->
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
<version>2.2.0.RELEASE</version> <!-- {x-version-update;org.springframework.boot:spring-boot-starter-validation;external_dependency} -->
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>azure-spring-boot</artifactId>
<version>2.2.5-beta.1</version> <!-- {x-version-update;com.microsoft.azure:azure-spring-boot;current} -->
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<version>3.0.0-M3</version> <!-- {x-version-update;org.apache.maven.plugins:maven-enforcer-plugin;external_dependency} -->
<configuration>
<rules>
<bannedDependencies>
<includes>
<include>com.microsoft.azure:*</include>
<include>org.springframework.boot:spring-boot-starter:[2.2.0.RELEASE]</include> <!-- {x-include-update;org.springframework.boot:spring-boot-starter;external_dependency} -->
<include>org.springframework.boot:spring-boot-starter-validation:[2.2.0.RELEASE]</include> <!-- {x-include-update;org.springframework.boot:spring-boot-starter-validation;external_dependency} -->
</includes>
</bannedDependencies>
</rules>
</configuration>
</plugin>
<!-- START: Empty Java Doc -->
<!-- The following code will generate an empty javadoc with just a README.md. This is necessary
to pass the required checks on Maven. The way this works is by setting the classesDirectory
to a directory that only contains the README.md, which we need to copy. If the classesDirectory
is set to the root, where the README.md lives, it still won't have javadocs but the jar file
will contain a bunch of files that shouldn't be there. The faux sources directory is deleted
and recreated with the README.md being copied every time to guarantee that, when building locally,
it'll have the latest copy of the README.md file.
-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.1.1</version> <!-- {x-version-update;org.apache.maven.plugins:maven-javadoc-plugin;external_dependency} -->
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
<configuration>
<skip>true</skip>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>3.1.2</version> <!-- {x-version-update;org.apache.maven.plugins:maven-jar-plugin;external_dependency} -->
<executions>
<execution>
<id>empty-javadoc-jar-with-readme</id>
<phase>package</phase>
<goals>
<goal>jar</goal>
</goals>
<configuration>
<classifier>javadoc</classifier>
<classesDirectory>${project.basedir}/javadocTemp</classesDirectory>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-antrun-plugin</artifactId>
<version>1.8</version> <!-- {x-version-update;org.apache.maven.plugins:maven-antrun-plugin;external_dependency} -->
<executions>
<execution>
<id>copy-readme-to-javadocTemp</id>
<phase>prepare-package</phase>
<configuration>
<target>
<echo>Deleting existing ${project.basedir}/javadocTemp</echo>
<delete includeEmptyDirs="true" quiet="true">
<fileset dir="${project.basedir}/javadocTemp"/>
</delete>
<echo>Copying ${project.basedir}/README.md to
${project.basedir}/javadocTemp/README.md
</echo>
<copy file="${project.basedir}/README.md" tofile="${project.basedir}/javadocTemp/README.md"/>
</target>
</configuration>
<goals>
<goal>run</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- END: Empty Java Doc -->
</plugins>
</build>
</project>
Loading